Empower Individuals with Transparency and Control Over TEFCA Data Sharing

Recommendation: ONC must ensure, through proactive engagement with the RCE and evolution of the TEFCA Common Agreement, Qualified Health Information Network Technical Framework (QTF), and associated Standard Operating Procedures (SOPs), that individuals have visibility into and control over how their data is exchanged under TEFCA. Individuals must have robust mechanisms to review audit logs and manage data sharing, accessible through TEFCA-designated services that ensure their choices are honored by all TEFCA QHINs and Participants.

Rationale & Specifics: Building public trust in TEFCA requires empowering individuals with direct oversight and control. The TEFCA framework, its participating QHINs, and connected Health IT systems must support the following:

1. TEFCA-level Patient Sharing Controls and Notifications via Discoverable Interfaces:

   • Individuals must be able to manage their TEFCA data sharing choices and notification settings through at least one clearly designated and easily accessible central point of interaction provided at the TEFCA level.
   • QHINs may also offer their own interfaces for managing these choices and settings, provided they are compatible with and reflect the authoritative settings managed via the TEFCA-level mechanism.
   • These sharing choices and notification settings, once set through a TEFCA-recognized interface, must be propagated and honored by all TEFCA QHINs and their Participants. Supported controls must include:
     • "Freeze Access" Capability: A mechanism for individuals to (reversibly) block all TEFCA-facilitated data disclosures for their data. This freeze would be registered through a TEFCA-level mechanism and honored by all QHINs and their Participants attempting to retrieve data for that individual via TEFCA.
     • "Ask Me First" for Query Approval/Disclosure: An option for individuals to require their explicit, real-time (or near real-time) consent via a notification (e.g., from their chosen QHIN or a TEFCA-designated function) before their data is released in response to specific TEFCA queries, especially for non-treatment purposes or other sensitive exchanges as defined by the individual or TEFCA policy. This represents a specific sharing choice configuration.
     • Network Access Notifications: An option for individuals to receive notifications for TEFCA-based queries or disclosures of their health records. (These could also serve as the trigger for "Ask Me First" approvals.)

2. Patient-Accessible TEFCA Audit Logs:

   • The RCE, under TEFCA, or a TEFCA-designated entity, must provide or facilitate a standardized, secure, cost-free, human-readable, and API-accessible method for individuals to obtain a comprehensive audit log of TEFCA-related activity, potentially accessible via the same interfaces used for managing sharing choices.
   • This log must reflect queries for their data and data disclosures across QHINs and their Participants operating under TEFCA, incorporating relevant audit information from QHINs and from participating data holders (e.g., EHR systems) regarding TEFCA-facilitated exchanges.
   • The architecture for providing this consolidated view must prioritize individual privacy and data minimization. This can be achieved by TEFCA-designated entities querying distributed audit logs maintained by participants (QHINs and data holders) in real-time or near real-time upon an authenticated patient's request, assembling a temporary, consolidated view for the individual, rather than creating a permanent, centralized repository of all log details.

3. Certified Health IT Support for Honoring TEFCA Patient Sharing Choices and Enabling TEFCA Audit Log Access:

   • Recommendation: The ONC Health IT Certification Program must include criteria requiring certified Health IT (used by TEFCA Participants/Subparticipants) to be capable of:
     • Receiving, interpreting, and honoring patient sharing choices (e.g., freeze, settings for "Ask Me First") that are communicated to them through TEFCA-designated mechanisms.
     • Securely responding to authorized audit log queries, initiated on behalf of a patient, by providing relevant local audit event data concerning TEFCA-facilitated exchanges.
   • Rationale: For TEFCA patient controls to be effective end-to-end, and for audit trails to be comprehensive and trustworthy for the patient, EHR systems at the point of data holding must act upon patient sharing choices communicated via TEFCA-designated mechanisms and enable their local TEFCA-related transaction data to be included in the patient's consolidated audit view of TEFCA-facilitated exchanges.
   • Specifics for EHR Certification:
     • Consumption and Honoring of TEFCA Patient Sharing Choices: Certified Health IT must be capable of subscribing to, receiving standardized signals or data from, and acting upon instructions from TEFCA-designated mechanisms responsible for conveying patient sharing choices. This includes appropriately withholding data or awaiting further network instruction based on an individual’s active sharing choices.
     • Responding to Authorized TEFCA Audit Log Queries: Certified Health IT must implement a standardized, secure API endpoint to receive and process authorized audit log queries. These queries, authenticated as being on behalf of a specific patient, would originate from TEFCA-designated services responsible for consolidating patient audit views, or potentially from other TEFCA-authorized client applications acting for the patient. Upon such a query, the EHR must return relevant local audit event data regarding TEFCA-facilitated exchanges for that patient.